CVE-2018-16529

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A password reset vulnerability has been discovered in Forcepoint Email Security 8.5.x. The password reset URL can be used after the intended expiration period or after the URL has already been used to reset a password.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-640

Affected software

Vendor	Product	Versions
Forcepoint	Forcepoint Email Security	8.5.x

References

https://help.forcepoint.com/security/CVE/CVE-2018-16529.htmlVendor Advisory
https://seclists.org/fulldisclosure/2018/Nov/23Exploit, Mailing List, Third Party Advisory
https://help.forcepoint.com/security/CVE/CVE-2018-16529.htmlVendor Advisory
https://seclists.org/fulldisclosure/2018/Nov/23Exploit, Mailing List, Third Party Advisory

Timeline

Published: Mar 28, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-16535.4IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 is vulnerable to cross-site scripting. This vulnerabil CVE-2018-165309.8A stack-based buffer overflow in Forcepoint Email Security version 8.5 allows an attacker to craft malicious input and potentially crash a p CVE-2018-165395.5In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect access checking in temp file handl CVE-2018-16546.1IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, 7.0.1, and 7.0.3 could allow a remote attacker to conduct phishing attacks, using a CVE-2018-165407.8In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files to the builtin PDF14 converter could use a use-after-f CVE-2018-165415.5In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect free logic in pagedevice replaceme CVE-2018-165425.5In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use insufficient interpreter stack-size checking CVE-2018-165437.8In Artifex Ghostscript before 9.24, gssetresolution and gsgetresolution allow attackers to have an unspecified impact.CVE-2018-165457.8Kaizen Asset Manager (Enterprise Edition) and Training Manager (Enterprise Edition) allow a remote attacker to achieve arbitrary code execut CVE-2018-165465.9Amcrest networked devices use the same hardcoded SSL private key across different customers' installations, which allows remote attackers to CVE-2018-165486.5An issue was discovered in ZZIPlib through 0.13.69. There is a memory leak triggered in the function __zzip_parse_root_directory in zip.c, w CVE-2018-165495.3HScripts PHP File Browser Script v1.0 allows Directory Traversal via the index.php path parameter.